Dark Web Intel: 15,844 DashboardWidgets Passwords Exposed

HEROIC analysts spotted a set of roughly 15,844 records from DashboardWidgets, a now-defunct US platform that once served as a directory and community for Mac OS desktop widgets, circulating on a dark web hacking forum. The breach is dated August 24, 2018, and the exposed data consists of email addresses paired with MD5 hashed passwords.

Why This Is Dangerous

MD5 is a weak hashing algorithm by today's standards. Attackers can run these hashes through widely available cracking tools and rainbow tables to recover the original passwords relatively quickly. Once a password is cracked, the attacker has a working email and password combination that can be tested against other accounts, particularly damaging if the original DashboardWidgets user reused that password elsewhere.

What Was Exposed in the DashboardWidgets Breach

• Email addresses
• Password hashes (MD5)

Why This Matters

Even though DashboardWidgets shut down years ago, its user data did not disappear with it. The appearance of this dataset on a dark web forum means it is likely being folded into combolists used for credential stuffing, the practice of testing stolen login pairs against email providers, social media accounts, and financial services. Anyone who created an account on this now-defunct site and reused the same password elsewhere faces a real risk of account takeover and identity theft.

How This Database Breach and Combolist Exposure Works

This incident is classified as a database breach that was later distributed as a combolist. A database breach occurs when an attacker gains unauthorized access to a site's stored user records, often through a software flaw or an unsecured server, and extracts the data in bulk. That stolen data is then combined with records from other breaches into a combolist, a large file of email and password pairs that criminals feed into automated tools to attempt logins across many other websites. Dark web forums like the one this data surfaced on serve as the main distribution point for these combolists, keeping old breaches like this one relevant to attackers years after the fact.

Check If You Are Affected

If you ever had an account on DashboardWidgets, or if you tend to reuse passwords across different sites, it is worth checking whether your information is part of this exposure. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this one, so you can find out what has been exposed and secure your accounts before someone else does.